Overview

overview

8

Static

static

murofet_0....ir.exe

windows7_x64

8

murofet_0....ir.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    murofet_0.0.0.3.vir

  • Size

    148KB

  • Sample

    200719-71r3g81mz2

  • MD5

    7e186ad404f718e02585d82c0436e200

  • SHA1

    280c03893a96686762c5616dc7ff94a944b00bdd

  • SHA256

    9b18a3d6d3381cce0f58f433e0bc7bddcf12b7ffde0094ce8842239ad72da570

  • SHA512

    eaaecc8859cd0640f2e7619309496d7d61410f32f957f1a284cea778f7296192262f2874615eb4c68aff8d2b15d21e623e0bac598e41cab58c9fe18621240e7d

Score
8/10
persistence

Malware Config

Targets

    • Target

      murofet_0.0.0.3.vir

    • Size

      148KB

    • MD5

      7e186ad404f718e02585d82c0436e200

    • SHA1

      280c03893a96686762c5616dc7ff94a944b00bdd

    • SHA256

      9b18a3d6d3381cce0f58f433e0bc7bddcf12b7ffde0094ce8842239ad72da570

    • SHA512

      eaaecc8859cd0640f2e7619309496d7d61410f32f957f1a284cea778f7296192262f2874615eb4c68aff8d2b15d21e623e0bac598e41cab58c9fe18621240e7d

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks